2026 Benchmark Report
2026 Subcontractor COI Compliance & Risk Transfer Benchmark Report
Where subcontractor certificates fail, by trade and by deficiency, what a denied tender costs, and how long manual chasing takes. Built from the certificates and endorsement packets Pikorua Security reviews, read alongside the industry studies cited beside every number.
Pikorua Security Research
2026 edition71%
of subcontractor COIs are deficient on first review
AGC Risk Committee Audit
- Roofing84%
- Structural steel78%
- Electrical62%
Data window January 2025 to June 2026 · Licensed CC BY 4.0
Executive summary
Seven in ten certificates fail the first review.
- of subcontractor and vendor COIs contain material coverage deficiencies or missing endorsements on first review
- 71%
- of subcontractor and vendor COIs contain material coverage deficiencies or missing endorsements on first review
- AGC Risk Committee Audit
- of COIs claiming additional insured status fail to attach the CG 20 37 completed operations endorsement
- 64%
- of COIs claiming additional insured status fail to attach the CG 20 37 completed operations endorsement
- IRMI Construction Risk Survey
- of submitted certificates list an incorrect named insured entity (trade name vs. formal LLC)
- 48%
- of submitted certificates list an incorrect named insured entity (trade name vs. formal LLC)
- National Construction Risk Audit
- of active subcontractor policies expire mid-project unnoticed when tracked in spreadsheets
- 25% to 35%
- of active subcontractor policies expire mid-project unnoticed when tracked in spreadsheets
- Pikorua Security Benchmark Data
- 01
The trade drives the defect rate.
Roofing certificates fail first review 84% of the time and electrical 62%, a 22-point spread across the eight trades benchmarked. Review effort should follow that spread.
- 02
Completed operations is the gap that matters most.
64% of certificates claiming additional insured status do not attach CG 20 37, so the GC is unprotected once the work is finished, exactly when defect claims arrive.
- 03
Entity errors are nearly as common.
48% of certificates list a named insured that differs from the contracting entity, a trade name instead of the LLC that signed the subcontract.
- 04
Spreadsheets lose track of renewals.
25% to 35% of active subcontractor policies expire mid-project without anyone noticing when they are tracked by hand.
- 05
One denied tender outweighs years of prevention.
A rejected additional insured tender costs $150,000 to $450,000 out of pocket, and the premium increase that follows runs 15% to 35% for at least three policy years.
- 06
Manual chasing is slow; automated chasing is not.
Resolving one non-compliant COI by hand takes 28 days. Pikorua Security customers close broker deficiencies in 4.2 days.
Defect rate by trade
Roofing fails most often. Electrical fails least, and still fails 62% of the time.
The share of certificates that fail at least one exhibit requirement on first submission, for eight trades. The unweighted mean of the eight is 72%, against the 71% all-subcontractor rate from the AGC Risk Committee Audit. Sort the chart, show each trade's gap to that benchmark, and select a trade to see where its packets usually break.
Share of subcontractor certificates deficient on first review, by trade, compared with the 71% all-subcontractor rate from the AGC Risk Committee Audit.
Selected trade
Roofing
84%13 pts above 71%
Roughly 8 in 10 roofing certificates fail at least one exhibit requirement the first time they are submitted.
What to watch
Height limitations, hot work and residential restrictions, and missing completed operations forms on work that draws leak claims years later.
- Mean of 8 trades
- 72%
- High to low spread
- 22 pts
Deficiency categories
What actually fails inside a deficient packet
No completed ops AI
64%
of deficient certificates carried this finding
How it gets fixed
Ask the producer for CG 20 37, or a blanket completed operations form, that reaches your entity. Ongoing operations forms stop responding when the work is complete, which is when defect claims arrive.
Financial impact
A denied tender lands on your retention, then on your renewals.
Typical GL self-insured retention
$50,000 to $250,000
Mid-market GCs, $25M to $100M revenue · Commercial Casualty Actuarial Study
Out-of-pocket loss after a denied AI tender
$150,000 to $450,000
Litigation plus SIR, average range · Commercial Casualty Actuarial Study
Pikorua Security Professional, one full year
$8,388
$699 per month, billed annually
At the low end of the range, one denied tender costs about 18 years of Pikorua Security Professional.
- Added premium, each renewal
- $60,000 to $140,000
- Over 3 policy years, at least
- $180,000 to $420,000
Applies the 15% to 35% increase for a minimum of 3 policy years after one un-tendered catastrophic claim (Commercial Casualty Actuarial Study) to the premium you set. It excludes the retention and defense spend on the claim itself.
Time and administrative drag
The hours go into reading, chasing and waiting.
Cycle time
From first deficiency to verified fix
Manual: collect, audit, chase, resolve
28 days
Pikorua Security Benchmark Data
Pikorua Security customers: broker resolution
4.2 days
Pikorua Security customer outcomes
Most of the manual cycle is waiting: for the subcontractor to forward the request, for the producer to issue a corrected certificate, and for someone on the project team to find time to review it again. Sending the deficiency letter to the vendor and its producer at once, with a specific list of missing forms, removes most of that wait.
Review time per packet
25 to 40 min
to manually review one COI and multi-page endorsement packet against contract specifications.
For 150 subcontractors, first review alone is 63 to 100 hours, before a single renewal or chase.
CFMA Time Study
Payment delays
1 in 8 subcontractor payment delays are caused by unresolved COI compliance holds, which strains trade relationships and opens mechanics' lien exposure.
Pikorua Security Benchmark Data
Worked example
A $50M commercial GC with 150 subcontractors a year
Four review hours per subcontractor per year covers the first review, renewals and chasing, at a $45 loaded hourly cost.
| Measure | Calculation | Result |
|---|---|---|
| Non-compliant subcontractors | 150 x 71% | about 106 |
| Manual review and chasing | 150 x 4 hours | 600 hours / year |
| Administrative payroll | 600 x $45 | $27,000 / year |
| Pikorua Security Professional | $699 x 12, billed annually | $8,388 / year |
| Administrative hours recovered | Review and chasing automated | 520 hours / year |
Methodology
How the dataset is built
Every figure on this page carries its source. Pikorua Security measurements and outside studies are never blended into a single number.
Two kinds of figures
The report combines Pikorua Security's own measurements with published industry studies. The trade defect rates, the deficiency category shares, the mid-project expiry rate, the manual cycle time and the payment delay ratio are Pikorua Security Benchmark Data. The first-review defect rate, the completed operations and named insured findings, the financial impact ranges and the manual review time come from the outside studies credited beside them, and are reported as those studies published them.
Where Pikorua Security's data comes from
Pikorua Security Benchmark Data is drawn from subcontractor and vendor certificates of insurance, and the endorsement packets attached to them, processed through Pikorua Security between January 2025 and June 2026. That includes the files customers bring over from spreadsheets and shared drives during onboarding, which is where the mid-project expiry rate and the manual cycle time are measured, before automated chasing is switched on.
How a deficiency is counted
A certificate counts as deficient when its packet fails at least one requirement of the governing contract insurance exhibit on first review. Failures include a missing or wrong-edition endorsement, a named insured that differs from the contracting entity, a limit below the exhibit, a carrier below the required AM Best rating, and a policy that has expired or expires within 30 days. A packet that fails on three counts is one deficient certificate in the trade rate and appears in three category shares, which is why the categories overlap.
How trades are assigned
Each certificate is assigned to one trade from the scope of work in the subcontract it was submitted against. Specialty contractors with mixed scopes are assigned by their primary scope. Only trades with enough packets to report a stable rate are shown.
Privacy
Figures are aggregated across customers before publication. No customer, vendor, producer or carrier is named or identifiable, no policyholder contact details are used, and no customer certificate or contract is used to train AI models.
What this report is not
It measures whether documents prove the coverage contracts require. It does not judge whether a claim would be covered, and it is not legal or insurance advice. Pikorua Security is software; it is not an insurance agency or broker.
Pikorua Security. 2026 Subcontractor COI Compliance & Risk Transfer Benchmark Report. pikoruasecurity.com/resources/benchmarks. Licensed CC BY 4.0.
Full report
Get the complete benchmark by email
- Trade tables with each trade's most common deficiency categories
- Category definitions and the exhibit rule each one is checked against
- The financial impact model with the SIR and premium assumptions shown
- A one-page summary formatted for a risk committee or executive review
Want the same review run on your own files? Audit 5 COIs free.
Sources
Sources and attribution
Cited in this report
- 1.AGC Risk Committee Audit71% first-review defect rate
- 2.IRMI Construction Risk Survey64% missing CG 20 37 completed operations
- 3.National Construction Risk Audit48% named insured mismatch
- 4.Commercial Casualty Actuarial Study$150,000 to $450,000 denied tender loss; $50,000 to $250,000 SIR; 15% to 35% premium increase
- 5.CFMA Time Study25 to 40 min manual review per packet
- 6.Pikorua Security Benchmark DataTrade rates, deficiency categories, 25% to 35% mid-project expiry, 28 days cycle, 1 in 8 payment delays
- 7.Pikorua Security customer outcomes28 days to 4.2 days broker resolution; 99.4% endorsement verification accuracy across ISO forms
Background references
- Associated General Contractors of America (AGC), Risk Management Committee studies
- International Risk Management Institute (IRMI), construction risk management guidelines
- Construction Financial Management Association (CFMA)
- Risk and Insurance Management Society (RIMS)
- ISO (Insurance Services Office) form documentation
Questions
About this report
Can I cite or republish figures from this report?
Does a deficient certificate mean the subcontractor is uninsured?
Are any customers, vendors or policyholders identifiable in the data?
How often is the benchmark updated?
Is this report legal or insurance advice?
14-day free production trial
Find out which of your subcontractors are in the 71%.
Upload five current certificates with their endorsement packets. Pikorua Security checks every page against your exhibit and shows each hidden defect.